Skip to main content

Notice

Please note that most of the software linked on this forum is likely to be safe to use. If you are unsure, feel free to ask in the relevant topics, or send a private message to an administrator or moderator. To help curb the problems of false positives, or in the event that you do find actual malware, you can contribute through the article linked here.
Topic: Help regarding understanding Forensic Report (Read 2362 times) previous topic - next topic
0 Members and 1 Guest are viewing this topic.

Help regarding understanding Forensic Report

Greetings to all. I am new to this forum. I am complete non-techie. Dear learned forum members I have an 5 mb audio file in wave format which I got examined in USA for authenticity and tampering if any. The forensic company has submitted its report, which however I am unable to understand, unluckily the company is very slow in responding to mails. For information this audio has been recorded in a philips gogear mix 2gb version, I do not have the model no. I was supplied with a copy of the audio file on a CD. The examiner has concluded that the file is not authentic. I am attaching herewith the relevant pages of the report for ready reference. My questions are :
1. The media info of the file shows that the file is truncated, what does this mean? The hash checksum is a match for the file on the CD and the file on the Philips digital recorder.
2. The examiner has concluded that there is deletion at the beginning and end but no indication of exact place and other details of deletions have been provided. On enquiring the company informed through mail as quoted “ Changing the format of the audio impacted our ability to determine duration, date/time of the recording.  To obtain this information, we’ll need to gain access to the original recording.   Audio creator did everything possible to conceal origin of this recording”. I am wondering how they have been able to conclude that there was deletion is out of my understanding. Can somebody help me understand this?
     I am sorry for the long post but I need help to understand this report.
Thanks in advance.
Aksingh
India






Re: Help regarding understanding Forensic Report

Reply #1
Dear moderators I am new to this forum so did not know which forum to post this query, if it needs to be moved kindly do so.
Rgds
Aksingh

Re: Help regarding understanding Forensic Report

Reply #2
Anyone....

Re: Help regarding understanding Forensic Report

Reply #3
How about you wait a few days for someone to reply to your topic?

Re: Help regarding understanding Forensic Report

Reply #4
Ok sir

Re: Help regarding understanding Forensic Report

Reply #5
I think you can do the following:
[1] Find the same recorder, maybe in Ebay/Amazon...?
[2] Record something with it, use different parameters, settings etc... try all of them
[3] Examine the recorded files to see if they have similar structure as that suspected file

You can use something like XVI32 to examine the binary content of your files.
http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm

Re: Help regarding understanding Forensic Report

Reply #6
Thank you very much sir will try that out.
Rgds


 

Re: Help regarding understanding Forensic Report

Reply #8
Thank you sir I have both now XVI32 as well as HxD...will try to understand the technicalities involved...
Rgds